TRICONEX 2201 通信控制模块

TRICONEX 2201 通信控制模块

TRICONEX 2201 与此同时，他打算说什么？当他的同事Bob Adamski在2005年领导了对艾默生、ABB和横河最近宣布的集成SIS产品的第一次反击时，攻击的主要焦点是他们的1oo2D架构，Adamski将其描述为“旧技术”，他认为这将“导致更多的麻烦”这一次，McCrea-Steele的论点似乎更加微妙，并将使用通用硬件平台作为其主要目标，他认为，这破坏了深度防御和独立保护层(IPLs)的整个概念，这要求控制和安全应该完全独立。如果基本过程控制系统(BPCS)，即安全术语中的DCS，和S is基于相同的硬件平台；是由同一个团队设计的。并且使用相同的HMI和配置工具，那么，他认为，不可能证明它们不会引起共同原因或系统故障。“问题在于对标准的解释，”麦克雷-斯蒂尔说。“IEC 61511-1条款9.5没有说你需要物理隔离或多样性，但其他条款暗示了相反的意思。”

那么，为什么tüV感觉能够认证这些系统呢？因为，麦克雷-斯蒂尔说，“电视孤立地证明了安全系统。该认证将验证影响SIS安全功能的DCS故障的非干扰性，但如果SIS嵌入控制系统，则消除了DCS作为IPL的信用。”

TRICONEX 2201 

为了支持他的论点，他引用了森科尔能源公司2006年关于艾默生DeltaV SIS的光谱设计报告，特别引用了以下段落，虽然承认“BPCS和SIS实际上是两个独立的系统，即使安装在同一个载体上”，但继续认为“为了在这种情况下获得任何独立的信用，必须证明BPCS或公共组件的故障不会导致任何SIS组件的故障。由于BPCS和SIS设备在同一个载波上使用共同的通信迹线，目前还不能充分满足这一要求。”

然而，McCrae-Steele在他的论文中没有告诉我们并且忽略了提及的是，Spectral Design仍然认为能够在其报告的结尾说“这项研究的一般结论是DeltaV SIS适用于森科尔的操作、维护和商业环境”，而执行摘要指出“DeltaV SIS将充分执行安全功能，并且应被森科尔考虑使用。”

实质上，TRICONEX 2201 认为，如果您使用基于相同硬件平台的BPCS和安全仪表系统，例如ABB的800xA HI系统、Yokogawa的ProSafe RS系统和DeltaV安全仪表系统(在较小程度上)分别与各自的DCS系统一起使用，那么您不能将它们算作独立的IPL，因为保护层分析(LOPA)假设BPCS的作用是减少对安全仪表系统的需求数量。这反过来意味着，只有当BPCS和安全仪表系统同时单独出现故障时，才会出现不安全的情况。

然而，麦克雷-斯蒂尔认为，如果BPCS和SIS基于相同的硬件平台，它们可能遭受共同的原因或系统故障。因此，基于BPCS和DCS正在提供IPL的假设，得出SIL 1和SIL 2安全仪表功能(SIF)的分析，当考虑到通用平台时，最终应主要得出SIL 2和SIL 3 SIFs。此外，一个具有SIL 3要求的项目将被提升到SIL 4，这将使整个方案重新开始。

网络安全

TRICONEX 2201 的另一个主要担忧集中在网络安全和与DCS的更紧密集成的可能性，因此，与外部世界的更紧密集成可能会使安全系统面临恶意攻击的风险。他认为，加工厂经理最可怕的噩梦是“一个嵌入DCS的安全系统，一个恶意的网络攻击者穿透连接到现场局域网或公司广域网的控制系统的防火墙，使SIS失效，并利用DCS炸毁工厂。”然而，在提出“安全系统作为最后一道防线，需要得到保护”后，他似乎削弱了自己的立场，提出解决方案是“信息、配置、资产管理和HMI级别的智能集成”，这听起来很像当前的Triconex解决方案。正如他所指出的，“所有系统都是脆弱的”，因此很难看出“智能集成”如何让安全系统比任何其他形式的集成更不容易受到恶意网络攻击。

很明显，Triconex在与集成SIS游说团的斗争中开辟了一条新战线，这可能会让一些集成系统的潜在用户停下来思考。麦克雷-斯蒂尔采取了一些人可能认为过于危言耸听的立场，这是否削弱而不是加强了独立系统的理由，将由其他人来判断。不幸的是，由于取消了加尔维斯顿研讨会，电视公司失去了就提出的问题进行早期辩论的机会。

TRICONEX 2201 通信控制模块

TRICONEX 2201 Communication control module

TRICONEX 2201 In the meantime, what is he going to say? When his colleague Bob Adamski led the first counterattack in 2005 against Emerson, ABB, and Yokogawa's recently announced integrated SIS products, the main focus of the attack was their 1oo2D architecture, which Adamski described as "old technology" that he thought would "lead to more trouble" this time around. McCrea-Steele's argument seems more nuanced and makes the use of a general-purpose hardware platform its main goal, which he argues undermines the whole concept of Defense in Depth and independent Protective Layers (IPLs), which requires that control and security should be completely separate. If the basic process control System (BPCS), or DCS in security terms, is based on the same hardware platform; It was designed by the same team. And using the same HMI and configuration tools, then, he argues, it's impossible to prove that they don't cause common causes or system failures. "The problem is the interpretation of the criteria," Ms. McRae-steele said. "IEC 61511-1 Clause 9.5 does not say you need physical segregation or diversity, but other provisions imply otherwise."

So why does tuV feel able to certify these systems? Because, McRae-steele says, "television proves the safety system in isolation." This certification will verify the non-interference of DCS failures that affect the safety function of SIS, but removes DCS 'credit as an IPL if SIS is embedded in the control system."

TRICONEX 2201

In support of his argument, he cites Suncor Energy's 2006 Spectral Design report on Emerson DeltaV SIS, specifically citing the following paragraph, which, while acknowledging that "BPCS and SIS are effectively two separate systems, even if installed on the same carrier," continues to argue that "in order to gain any independent credit in this case, It must be demonstrated that a failure of a BPCS or common component will not cause a failure of any SIS component. Since BPCS and SIS devices use a common communication track on the same carrier, this requirement is not yet fully met."

What McCrae-Steele doesn't tell us in his paper and neglectfully mentions, however, is that Spectral Design still feels able to conclude its report by saying "the general conclusion of this study is that DeltaV SIS is suitable for Suncor's operating, maintenance, and commercial environments." The executive summary states that "DeltaV SIS will fully perform safety functions and should be considered for use by Suncor."

In essence, TRICONEX 2201 believes that if you use BPCS and safety instrumentation systems based on the same hardware platform, For example, ABB's 800xA HI system, Yokogawa's ProSafe RS system, and (to a lesser extent) DeltaV Safety instrumentation system are used together with their respective DCS systems, so you can't count them as separate IPLs. Because the protective layer analysis (LOPA) assumes that the role of BPCS is to reduce the number of safety instrumentation systems required. This, in turn, means that an unsafe situation can occur only if the BPCS and the safety instrumentation system fail separately at the same time.

However, McRae-steele believes that if BPCS and SIS are based on the same hardware platform, they could suffer from common causes or system failures. Therefore, based on the assumption that BPCS and DCS are providing IPL, analyses of SIL 1 and SIL 2 safety instrument functions (SIFs) should ultimately be derived primarily from SIL 2 and SIL 3 SIFs when taking into account common platforms. In addition, a project with SIL 3 requirements will be promoted to SIL 4, which will allow the entire program to start over.

Network security

Another major concern with the TRICONEX 2201 centers on cybersecurity and the possibility of tighter integration with DCS, so tighter integration with the outside world could put security systems at risk of malicious attacks. He believes that a processing plant manager's worst nightmare is "a security system embedded in DCS, where a malicious cyber attacker penetrates the firewall of the control system connected to the field local area network or the company's wide area network, disables SIS, and uses DCS to blow up the plant." However, after proposing that "security systems need to be protected as the last line of defense," he seemed to weaken his position, proposing that the solution is "intelligent integration at the information, configuration, asset management and HMI levels," which sounds a lot like the current Triconex solution. As he points out, "all systems are vulnerable," so it's hard to see how "smart integration" makes security systems less vulnerable to malicious cyberattacks than any other form of integration.

It's clear that Triconex has opened a new front in its battle with the integrated SIS lobby, which may give some potential users of the integrated system pause for thought. It will be for others to judge whether McRae-steele has taken a position that some might consider too alarmist, rather than strengthening the case for an independent system. Unfortunately, with the cancellation of the Galveston workshop, the television companies lost the opportunity for an early debate on the issues raised.

TRICONEX 2201 通信控制模块